chore(zeppelin-web-angular): remediate npm audit findings in zeppelin-react

[jongyoul]

What is this PR for?

This PR remediates npm audit failures in the zeppelin-react module (zeppelin-web-angular/projects/zeppelin-react) on master.

What changes are proposed?

1. Upgrade webpack-dev-server: Updated webpack-dev-server to ^5.2.4 in package.json to resolve the moderate uuid and webpack-dev-server vulnerabilities.
2. Add audit-filter.js: Created a custom audit filtering script to handle the @antv/color-util and @antv/adjust malware false-positives (GHSA-rh6v-hwr4-6jcp / GHSA-qcp2-qp9h-qprg). Npm marked all versions of these packages as malware, causing all audit runs to fail even though the pinned versions in Zeppelin were published years before the compromise. This script filters out those specific advisories while still validating other high/critical security issues.
3. Update CI Workflow: Modified .github/workflows/frontend.yml to run the custom audit-filter.js instead of the raw npm audit command.

How should this be tested?

Verify that the npm-audit job passes in GitHub Actions.

[Copilot]

Pull request overview

This PR updates the zeppelin-react frontend audit flow to remediate current npm audit failures while allowing known @antv malware false-positive advisories to be filtered.

Changes:

• Upgrades webpack-dev-server to 5.2.4.
• Adds audit-filter.js to run and filter npm audit JSON output.
• Updates the frontend CI workflow to use the custom audit filter.

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated 4 comments.

File	Description
zeppelin-web-angular/projects/zeppelin-react/package.json	Updates the webpack-dev-server dev dependency range.
zeppelin-web-angular/projects/zeppelin-react/package-lock.json	Locks webpack-dev-server to 5.2.4.
zeppelin-web-angular/projects/zeppelin-react/audit-filter.js	Adds custom npm audit filtering for selected advisories.
.github/workflows/frontend.yml	Runs the new audit filter in the zeppelin-react audit job.

Files not reviewed (1)

• zeppelin-web-angular/projects/zeppelin-react/package-lock.json: Language not supported

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[jongyoul]

@tbonelee @ParkGyeongTae @voidmatcha I heard that @AntV had a security issue, so it's been fully deprecated. So npm-audit failed, so I removed them and used the vanilla one. Could you please check it?

[voidmatcha]

• npm audit on master: 21 advisories (10 moderate / 5 high / 6 critical, incl. the @antv/adjust & @antv/color-util malware advisories)
• Diff review: no new dangerouslySetInnerHTML / eval / dynamic Function introduced, and chart labels/data are drawn on a 2D canvas context. So the migration doesn't add any XSS surface.

LGTM from a supply-chain perspective.

[voidmatcha]

Suggested change

	data: data.map(d => data.value),
	data: data.map(d => d.value),

Original(master)

As-Is

To-Be

The callback references the outer data array instead of the element d, so data.value is undefined for every row and the Area Chart renders empty.